Skip to main content

Investigation Chat

Overview​

After an investigation completes, you can chat with it to ask follow-up questions, request deeper analysis, or clarify the findings. Investigation Chat gives you an interactive way to explore the investigation results with full context.

Investigation Chat vs Free-Form AI Chat​

OpsWorker has two distinct chat experiences. This page covers Investigation Chat:

Investigation ChatFree-Form AI Chat
ScopeOne specific completed investigationThe whole cluster, no investigation needed
Starting contextThe investigation's collected data, topology, root cause, and recommendationsA blank session
Best forGoing deeper on a finding, clarifying a recommendation, checking current stateAd-hoc questions, exploration, resource optimization, source-code lookups
AgentsGrounded in the investigation, with live cluster queriesThe full free-form agent registry (see AI Chat)

If you have not run an investigation and just want to ask about your cluster, use Free-Form AI Chat instead.

How It Works​

When you open a chat for a completed investigation, the AI has access to:

  • All data collected during the investigation (logs, events, configs)
  • The topology map of affected resources
  • The root cause analysis and recommendations
  • The ability to query the cluster for additional live data

This means you can ask specific questions and get answers grounded in your actual infrastructure, not generic advice.

Accessing Investigation Chat​

From the Portal​

  1. Navigate to Investigations and select an investigation
  2. Open the chat interface from the investigation detail page
  3. Type your question

From Slack​

Click the investigation link in the Slack notification to open it in the portal, then use the chat interface.

Example Interactions​

Diving Deeper into Root Cause​

You: Why specifically did this pod get OOMKilled?
AI: The pod api-gateway-7d8f9b6c4-x2k9p was OOMKilled because its memory
    limit is set to 256Mi, but the container's RSS peaked at 312Mi based
    on the events timeline. The logs show a connection pool growing
    without bounds starting at 14:23 UTC...

Requesting Specific Data​

You: Show me the last 50 lines of logs before the crash
AI: Here are the relevant log lines from container api-gateway...

Understanding Recommendations​

You: Why do you recommend increasing the memory limit instead of fixing the leak?
AI: Both are recommended. The immediate action (increasing the limit to 512Mi)
    prevents crashes while you investigate the connection pool leak. The
    preventive measure addresses the underlying cause...

Checking Current State​

You: Is the pod running now?
AI: [queries cluster] The pod api-gateway-7d8f9b6c4-x2k9p has been replaced
    by api-gateway-7d8f9b6c4-m3n7q, which is currently Running with 0 restarts.

Conversation Features​

  • Multi-turn: ask multiple follow-up questions; the AI maintains conversation context
  • Live data access: the AI can query your cluster in real time for current state
  • Integration-aware: chat can use the Kubernetes data already collected, plus configured integrations such as Git and Grafana MCP (metrics). Datadog is an alert source only and is not queried in chat.
  • Real-time responses: WebSocket-based communication for immediate feedback

Next Steps​